SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks

SonicWall has shipped patches for seven SonicOS vulnerabilities after confirming that one of them, an SSL-VPN authentication bypass tracked as CVE-2026-19868, has already been exploited in a real-world attack. The bug, rated 7.1 on CVSS, lets an attacker who already holds valid credentials for a secondary login method sidestep SAML-based checks, effectively defeating SAML-enforced multi-factor authentication on SSL-VPN connections. CISA has added the issue to its Known Exploited Vulnerabilities catalog and given federal agencies until November 20, 2026 to remediate. The same update also closes two 8.8-severity management-interface bugs allowing unauthenticated attackers to run unauthorized operations, plus pre-auth buffer overflows in SSL-VPN and TACACS+ that can trigger denial-of-service, and a weak password-hashing issue in virtual appliances. Affected are SonicOS Gen7 up to 7.3.3-7015 and Gen8 up to 8.2.2-8015; fixes land in 7.3.4-7013 and 8.2.3-8015, with SonicWall noting no workarounds exist. The disclosure follows a string of recent attacks against SonicWall's SMA1000 remote-access gear, including chained zero-days used for remote code execution and malware deployment earlier this year.